Detalle_Adjunto_732.zip
- SHA256 8c5008b229526f10211eb539c4a7afca566a60689552a51ad9fe18e00eef995d
Behavioral task
behavioral1
Sample
/\t/xPoPt15/ ZI41YPF081RJ8JBZNAPFZHSM.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
/\t/xPoPt15/ ZI41YPF081RJ8JBZNAPFZHSM.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target Detalle_Adjunto_732.zip
- Size 480KB
- Sample260812-ppm71scf29
- SHA256 8c5008b229526f10211eb539c4a7afca566a60689552a51ad9fe18e00eef995d
- MD5 948111aa1383c10ec7e3e7f303f26533
- SHA1 dd679a9147b4be943f6a440b36d52e0da46f69ba
- SHA512 ea5dac2129e51e0903bb05e28f6f4695025d8113c3e5bea1447dbf5c405b552cf0f409a92405444019eea14563ebf6eebc9f9cc0c72242c8c445422b5a215f63
- SSDEEP 12288:vnL36rrXKCfTmgyUnOgmM6lxoOo+q3NQzdKrT6BRWe:WrjFfTfyUnQM6laOo+q3NUdsuYe
- TLSH T1C5A433E10BB25A4F8E2EC56BFCA3EC89EA7A05F27D521D4E13B6021597C0651586C3CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/ /\t/xPoPt15/ ZI41YPF081RJ8JBZNAPFZHSM upx - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/out.upx
File Explorer
-
Detalle_Adjunto_732.zip.zip 480KB
-
/\t/xPoPt15/ ZI41YPF081RJ8JBZNAPFZHSM.exe 492KB
-
out.upx.exe 188KB
-
Detalle_Adjunto_88º.HTA.html .js 16KB
/\t/xPoPt15/ ZI41YPF081RJ8JBZNAPFZHSM
- SHA256 81725dd3e5adb872f3832401911291b3d178a30989b3dc561ef2313ea98a9d23
- MD5 6be012f6d8b607074f72f5920226033a
- SHA1 b60f084813be95b28428ed8f3d8e0a6e989ffbfb
- SHA512 43592fc96233a04c6ed378143f2e44233def8a9a71de6d6fd0fb9709a8a1c46857d5bad532ddceff28a6aca8cb6beaba72bca5e58a8e79c7d08c902817766962
- SSDEEP 12288:5MROxTfOnMmXkQmgIUnUgmMalxCOeWq3zQz/KrTbJN:mIxinvXXfIUn+MalcOeWq3zU/sVN
- TLSH T100B422F10EA008CFDC53E877BC26999B9D7A5EF220058D6B4A39B8547F83923151D39B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
fc:d6:7d:f4:36:48:c4:d5:24:2b:e3:e4:3f:a8:83:a6:19:62:d3:eb:9a:02:fd:2a:99:a4:92:9f:5a:45:aa:dd
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Mozilla Corporation,OU=Firefox Engineering Operations,O=Mozilla Corporation,L=San Francisco,ST=California,C=US
Chains
Jun 1, 2026
CN=Mozilla Corporation,OU=Firefox Engineering Operations,O=Mozilla Corporation,L=San Francisco,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Mozilla Corporation,OU=Firefox Engineering Operations,O=Mozilla Corporation,L=San Francisco,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 9, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=Dummy
Serial Number
7e:89:b9:df:00:6b:d1:aa:4c:48:d8:65:03:96:34:ca
Issuer
CN=Dummy
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 1, 2013 - Jan 2, 2013
Subject
CN=Mozilla Corporation,OU=Firefox Engineering Operations,O=Mozilla Corporation,L=San Francisco,ST=California,C=US
Serial Number
0f:0e:f7:c2:d8:19:27:3e:8c:13:f0:16:d2:e0:9b:25
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jan 9, 2025 - Jan 8, 2027
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Minor OS version
0
Major OS version
4
Entry point
216992
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
144KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
64KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
63KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=7, id=14, version=7299,
count=2, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=3, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=172, id=1, productName=Unmarked objects,
count=26, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=73, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
out.upx
- SHA256 d010265be33ead064c15604dcf5e90bf9f0608585eb9a04171294941e14a95a2
- MD5 2a779706848199e597315870c4b077d4
- SHA1 48c674022d55ddb45d741c9c901204471ac973c7
- SHA512 b092be4b0276c4fdc95ffa9635ae7be9b7babb0d3aa99bf9b6e17b8d53fc3351b1e0934ffc19639da89e580f028c5e9c38a2e78f84a071ddb546e619cf41889c
- SSDEEP 3072:488bdXF8FtO5dyzEAKZ/hx7c3unn+b09CIWncYodntK+C7VieM3SFZNt9ckP:XsdXFryQfP7nn+b0AvncfdwX3MmIO
- TLSH T14414AE323AD5C8FAD2532271CB49B7EAE1FADB180814493323142E5D7FBE846931D61E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
106406
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
105KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
63KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=7, id=14, version=7299,
count=2, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=3, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=172, id=1, productName=Unmarked objects,
count=26, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=73, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
Detalle_Adjunto_88º.HTA
- SHA256 a5ea26483eb838ddce6ef0a9aa41da4f0624f33ff31e644d3e706cec16e4c475
- MD5 eda2bed431866e8265f0d61cff65208a
- SHA1 c76243f5b1e8bb58e68511cf346288d88d7ac315
- SHA512 97294e2884406d5d36ac1e8f17be35512eeabc8f71164cb133eba7c552f53e63a961953029b92be76bcf9e4cddb5d577c30840f7c0e28bf7976bb921d746f281
- SSDEEP 192:aTAo+uD5TAG10bbZbgVkaXj5IK5Mh+6caRc/7T/BpMYugHI++xZOYFUDhTQU4Lt5:aTAdTGO5KqGRjEY7v7YFRU4ZA0
- TLSH T17672FA269940111934338371EFA6A74EFB7AD0138306431879ED62096FF65C9CA17FF8
- MD5 SHA1 SHA512 SSDEEP TLSH